MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4effc832d17d1b4d00e5b98bda9954f7c2684795db2451d4c2f056c84a0eff18. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

NetWire

Vendor detections: 10

Intelligence 10 IOCs YARA 2 File information Comments 1

SHA256 hash:	4effc832d17d1b4d00e5b98bda9954f7c2684795db2451d4c2f056c84a0eff18
SHA3-384 hash:	dad58a0e2eea28b64af5a7e9f81fa5ab389de0c371825dd7b6e7c368de1ab1f076a418b17e386a001b703f4bd70287b9
SHA1 hash:	0ede862c21205f17d01ec6b2929595393ba8d9a1
MD5 hash:	bb9c19cc629396d0cfd7ab3072887ae2
humanhash:	pluto-earth-alanine-avocado
File name:	bb9c19cc629396d0cfd7ab3072887ae2.exe
Download:	download sample
Signature	NetWire Create hunting rule
File size:	1'029'120 bytes
First seen:	2021-05-21 16:14:31 UTC
Last seen:	2021-05-21 17:37:42 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep	24576:Xqz4gwB0W319MeRjNCSkGXddFyUICfLc:Xqz4J1TNR4Sk0ddFxLc
Threatray	5'437 similar samples on MalwareBazaar
TLSH	AE25ADC1AE8ABA1EC12E7770301151FCC3A36C6615DDE7EA1AC7FDCA97A724052907D2
Reporter	abuse_ch
Tags:	exe NetWire RAT

Intelligence

File Origin

# of uploads :

# of downloads :

340

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

bb9c19cc629396d0cfd7ab3072887ae2.exe

Verdict:

Suspicious activity

Analysis date:

2021-05-21 16:36:14 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/c011ed0a-329a-4515-a0b8-6e68c868f40a

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection(s):

SecuriteInfo.com.Trojan.PackedNET.747-1.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Sending a UDP request

Result

Verdict:

UNKNOWN

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Result

Threat name:

FormBook

Detection:

malicious

Classification:

troj.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/787446

Signature

.NET source code contains potential unpacker

Antivirus detection for URL or domain

C2 URLs / IPs found in malware configuration

Found malware configuration

Injects a PE file into a foreign processes

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Maps a DLL or memory area into another process

Modifies the context of a thread in another process (thread injection)

Multi AV Scanner detection for submitted file

Queues an APC in another process (thread injection)

Sample uses process hollowing technique

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

System process connects to network (likely due to code injection or exploit)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to detect virtualization through RDTSC time measurements

Yara detected AntiVM3

Yara detected FormBook

Behaviour

Behavior Graph:

Download SVG

Detection:

formbook

Link:

https://mwdb.cert.pl/sample/4effc832d17d1b4d00e5b98bda9954f7c2684795db2451d4c2f056c84a0eff18/

Threat name:

ByteCode-MSIL.Trojan.Pwsx

Status:

Malicious

First seen:

2021-05-21 11:20:28 UTC

AV detection:

14 of 29 (48.28%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=j374qmwrpunu2ahfxgf5vgku67bgqr4v3msfdvgc6blmqsqo74ma._file

Verdict:

malicious

Label(s):

formbook

Result

Malware family:

xloader

Score:

10/10

Tags:

family:xloader loader rat

Link:

https://tria.ge/reports/210521-6x3x7hp792/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Suspicious use of SetThreadContext

Xloader Payload

Xloader

Malware Config

C2 Extraction:

http://www.adultpeace.com/p2io/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Formbook

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/4effc832d17d1b4d00e5b98bda9954f7c2684795db2451d4c2f056c84a0eff18

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	pe_imphash Create hunting rule

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

NetWire

exe 4effc832d17d1b4d00e5b98bda9954f7c2684795db2451d4c2f056c84a0eff18

(this sample)

URLhaus

https://urlhaus.abuse.ch/url/1261812/

Delivery method

Distributed via web download

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

a̵c̵c̸i̵d̷e̵n̷t̴a̷l̴r̵e̷b̸e̴l̸ commented on 2021-05-21 17:11:21 UTC

============================================================
MBC behaviors list (github.com/accidentalrebel/mbcscan):
============================================================
0) [B0009.029] Anti-Behavioral Analysis::Instruction Testing